角色与权限

本页面介绍了访问 Cloud Network Insights 所需的 Identity and Access Management (IAM) 角色和权限。如需了解有关 IAM 的详细说明，请参阅 Identity and Access Management 文档。

您可以授予用户或服务账号权限或预定义角色，也可以创建使用所指定权限的自定义角色。

在 Google Cloud 中授予用户的角色会在 AppNeta 中复制。如果您可以在 Google Cloud 控制台中修改 Cloud Network Insights 资源，则可以在 AppNeta 中修改这些资源。

角色

本节介绍在授予 Cloud Network Insights 权限时如何使用预定义角色和自定义角色。

Cloud Network Insights 的预定义角色

Cloud Network Insights 具有以下预定义角色，可让您启用 Cloud Network Insights 并修改所有 Cloud Network Insights 资源（管理员）、修改所有 Cloud Network Insights 资源（编辑者）或查看资源（Viewer）：

  • Cloud Network Insights 管理员 (roles/networkmanagement.CloudNetworkInsightsAdmin)
  • Cloud Network Insights 编辑者 (roles/networkmanagement.CloudNetworkInsightsEditor)
  • Cloud Network Insights 查看者 (roles/networkmanagement.CloudNetworkInsightsViewer)

预定义的 Network Management 角色还包含与 Cloud Network Insights 权限相同的权限。

Cloud Network Insights 管理员 (roles/networkmanagement.CloudNetworkInsightsAdmin) 和 Cloud Network Insights 编辑者 (roles/networkmanagement.CloudNetworkInsightsEditor) 角色都可以修改所有 Cloud Network Insights 资源。但是，只有 Cloud Network Insights 管理员角色才能在首次在项目中启用 Cloud Network Insights 时接受 Broadcom 服务条款。启用 Cloud Network Insights 后，拥有任一角色的用户都可以启用或停用 Cloud Network Insights。

如果您想授予用户在已启用 Cloud Network Insights 的项目中查看 Cloud Network Insights 或读取遥测和路径数据的能力，可以授予用户 Cloud Network Insights 查看者 (roles/networkmanagement.CloudNetworkInsightsViewer)

如需详细了解如何授予角色，请参阅管理对项目、 文件夹和组织的访问权限。

Cloud Network Insights 角色

下表介绍了 IAM 预定义角色及其与 Cloud Network Insights 关联的权限。

如需了解详情，请参阅 IAM 权限参考。

角色 权限

Cloud Network Insights 管理员

(roles/networkmanagement.CloudNetworkInsightsAdmin)
拥有对 Cloud Network Insights 资源的完整访问权限。
在首次在项目中启用 Cloud Network Insights 时接受 Broadcom 服务条款。
您可以授予此角色的最低级层资源：
  • 项目
  • networkmanagement.locations.get
  • networkmanagement.locations.list
  • networkmanagement.monitoringpoints.downloadConfig
  • networkmanagement.monitoringpoints.get
  • networkmanagement.monitoringpoints.list
  • networkmanagement.networkpaths.get
  • networkmanagement.networkpaths.list
  • networkmanagement.operations.get
  • networkmanagement.operations.list
  • networkmanagement.providers.create
  • networkmanagement.providers.delete
  • networkmanagement.providers.generateProviderAccessToken
  • networkmanagement.providers.get
  • networkmanagement.providers.list
  • networkmanagement.webpaths.get
  • networkmanagement.webpaths.list
  • productrequirementsservice.requirements.check
  • productrequirementsservice.requirements.record
  • resourcemanager.organizations.get
  • resourcemanager.organizations.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Cloud Network Insights 编辑者

(roles/networkmanagement.CloudNetworkInsightsEditor)
拥有对 Cloud Network Insights 资源的编辑权限。
您可以授予此角色的最低级层资源：
  • 项目
  • networkmanagement.locations.get
  • networkmanagement.locations.list
  • networkmanagement.monitoringpoints.downloadConfig
  • networkmanagement.monitoringpoints.get
  • networkmanagement.monitoringpoints.list
  • networkmanagement.networkpaths.get
  • networkmanagement.networkpaths.list
  • networkmanagement.operations.get
  • networkmanagement.operations.list
  • networkmanagement.providers.create
  • networkmanagement.providers.delete
  • networkmanagement.providers.generateProviderAccessToken
  • networkmanagement.providers.get
  • networkmanagement.providers.list
  • networkmanagement.webpaths.get
  • networkmanagement.webpaths.list
  • productrequirementsservice.requirements.check
  • resourcemanager.organizations.get
  • resourcemanager.organizations.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Cloud Network Insights 查看者

(roles/networkmanagement.CloudNetworkInsightsViewer)
拥有对 Cloud Network Insights 资源的只读权限，可查看遥测和路径数据。
您可以授予此角色的最低级层资源：
  • 项目
  • networkmanagement.monitoringpoints.get
  • networkmanagement.monitoringpoints.list
  • networkmanagement.networkpaths.get
  • networkmanagement.networkpaths.list
  • networkmanagement.providers.generateProviderAccessToken
  • networkmanagement.providers.get
  • networkmanagement.providers.list
  • networkmanagement.webpaths.get
  • networkmanagement.webpaths.list
  • productrequirementsservice.requirements.check
  • resourcemanager.organizations.get
  • resourcemanager.organizations.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

提醒和日志角色

下表介绍了 IAM 预定义角色及其关联的权限，可用于查看或管理基于 Cloud Network Insights 数据的提醒和日志。用户还需要 Cloud Network Insights 角色。

角色 权限

日志查看器

(roles/logging.viewer)
提供查看日志的权限。
您可以授予此角色的最低级层资源：
  • 查看
  • logging.buckets.get
  • logging.buckets.list
  • logging.exclusions.get
  • logging.exclusions.list
  • logging.links.get
  • logging.links.list
  • logging.locations.*
  • logging.logEntries.list
  • logging.logMetrics.get
  • logging.logMetrics.list
  • logging.logScopes.get
  • logging.logScopes.list
  • logging.logServiceIndexes.list
  • logging.logServices.list
  • logging.logs.list
  • logging.operations.get
  • logging.operations.list
  • logging.queries.getShared
  • logging.queries.listShared
  • logging.queries.usePrivate
  • logging.sinks.get
  • logging.sinks.list
  • logging.usage.get
  • logging.views.get
  • logging.views.list
  • observability.scopes.get
  • resourcemanager.projects.get

Logs Configuration Writer

(roles/logging.configWriter)
创建提醒政策。
您可以授予此角色的最低级层资源：
  • 查看
  • logging.buckets.create
  • logging.buckets.createTagBinding
  • logging.buckets.delete
  • logging.buckets.deleteTagBinding
  • logging.buckets.get
  • logging.buckets.list
  • logging.buckets.listEffectiveTags
  • logging.buckets.listTagBindings
  • logging.buckets.undelete
  • logging.buckets.update
  • logging.exclusions.*
  • logging.links.*
  • logging.locations.*
  • logging.logMetrics.*
  • logging.logScopes.*
  • logging.logServiceIndexes.list
  • logging.logServices.list
  • logging.logs.list
  • logging.notificationRules.*
  • logging.operations.*
  • logging.settings.*
  • logging.sinks.*
  • logging.sqlAlerts.*
  • logging.views.create
  • logging.views.delete
  • logging.views.get
  • logging.views.getIamPolicy
  • logging.views.list
  • logging.views.update
  • observability.scopes.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Monitoring NotificationChannel Editor Beta 版

(roles/monitoring.notificationChannelEditor)
创建与通知关联的提醒政策。
  • monitoring.notificationChannelDescriptors.*
  • monitoring.notificationChannels.create
  • monitoring.notificationChannels.delete
  • monitoring.notificationChannels.get
  • monitoring.notificationChannels.list
  • monitoring.notificationChannels.sendVerificationCode
  • monitoring.notificationChannels.update
  • monitoring.notificationChannels.verify

Monitoring AlertPolicy Viewer

(roles/monitoring.alertPolicyViewer)
查看提醒政策。
  • monitoring.alertPolicies.get
  • monitoring.alertPolicies.list
  • monitoring.alertPolicies.listEffectiveTags
  • monitoring.alertPolicies.listTagBindings

Monitoring AlertPolicy Editor

(roles/monitoring.alertPolicyEditor)
修改提醒政策。
  • monitoring.alertPolicies.*